* [dpdk-dev] [PATCH] lib/rte_eal: fix heap-use-after-free bug
@ 2020-04-21 3:29 Wei Hu (Xavier)
2020-04-21 12:54 ` Burakov, Anatoly
0 siblings, 1 reply; 3+ messages in thread
From: Wei Hu (Xavier) @ 2020-04-21 3:29 UTC (permalink / raw)
To: dev
From: "Wei Hu (Xavier)" <xavier.huwei@huawei.com>
This patch fixes the heap-use-after-free bug which was found by ASAN
(Address-Sanitizer) in the vfio_get_default_container_fd function.
Fixes: 6bcb7c95fe14 ("vfio: share default container in multi-process")
Cc: stable@dpdk.org
Signed-off-by: Chengwen Feng <fengchengwen@huawei.com>
Signed-off-by: Wei Hu (Xavier) <xavier.huwei@huawei.com>
---
lib/librte_eal/linux/eal_vfio.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/lib/librte_eal/linux/eal_vfio.c b/lib/librte_eal/linux/eal_vfio.c
index 4502aefed..1470b58c6 100644
--- a/lib/librte_eal/linux/eal_vfio.c
+++ b/lib/librte_eal/linux/eal_vfio.c
@@ -1092,6 +1092,7 @@ vfio_get_default_container_fd(void)
struct rte_mp_reply mp_reply = {0};
struct timespec ts = {.tv_sec = 5, .tv_nsec = 0};
struct vfio_mp_param *p = (struct vfio_mp_param *)mp_req.param;
+ int container_fd;
if (default_vfio_cfg->vfio_enabled)
return default_vfio_cfg->vfio_container_fd;
@@ -1114,8 +1115,9 @@ vfio_get_default_container_fd(void)
mp_rep = &mp_reply.msgs[0];
p = (struct vfio_mp_param *)mp_rep->param;
if (p->result == SOCKET_OK && mp_rep->num_fds == 1) {
+ container_fd = mp_rep->fds[0];
free(mp_reply.msgs);
- return mp_rep->fds[0];
+ return container_fd;
}
}
--
2.23.0
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [dpdk-dev] [PATCH] lib/rte_eal: fix heap-use-after-free bug
2020-04-21 3:29 [dpdk-dev] [PATCH] lib/rte_eal: fix heap-use-after-free bug Wei Hu (Xavier)
@ 2020-04-21 12:54 ` Burakov, Anatoly
2020-04-21 16:19 ` David Marchand
0 siblings, 1 reply; 3+ messages in thread
From: Burakov, Anatoly @ 2020-04-21 12:54 UTC (permalink / raw)
To: Wei Hu (Xavier), dev
On 21-Apr-20 4:29 AM, Wei Hu (Xavier) wrote:
> From: "Wei Hu (Xavier)" <xavier.huwei@huawei.com>
>
> This patch fixes the heap-use-after-free bug which was found by ASAN
> (Address-Sanitizer) in the vfio_get_default_container_fd function.
>
> Fixes: 6bcb7c95fe14 ("vfio: share default container in multi-process")
> Cc: stable@dpdk.org
>
> Signed-off-by: Chengwen Feng <fengchengwen@huawei.com>
> Signed-off-by: Wei Hu (Xavier) <xavier.huwei@huawei.com>
> ---
Acked-by: Anatoly Burakov <anatoly.burakov@intel.com>
--
Thanks,
Anatoly
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [dpdk-dev] [PATCH] lib/rte_eal: fix heap-use-after-free bug
2020-04-21 12:54 ` Burakov, Anatoly
@ 2020-04-21 16:19 ` David Marchand
0 siblings, 0 replies; 3+ messages in thread
From: David Marchand @ 2020-04-21 16:19 UTC (permalink / raw)
To: Wei Hu (Xavier); +Cc: dev, Burakov, Anatoly
On Tue, Apr 21, 2020 at 2:54 PM Burakov, Anatoly
<anatoly.burakov@intel.com> wrote:
>
> On 21-Apr-20 4:29 AM, Wei Hu (Xavier) wrote:
> > From: "Wei Hu (Xavier)" <xavier.huwei@huawei.com>
> >
> > This patch fixes the heap-use-after-free bug which was found by ASAN
> > (Address-Sanitizer) in the vfio_get_default_container_fd function.
> >
> > Fixes: 6bcb7c95fe14 ("vfio: share default container in multi-process")
> > Cc: stable@dpdk.org
> >
> > Signed-off-by: Chengwen Feng <fengchengwen@huawei.com>
> > Signed-off-by: Wei Hu (Xavier) <xavier.huwei@huawei.com>
> > ---
>
> Acked-by: Anatoly Burakov <anatoly.burakov@intel.com>
Applied, thanks.
--
David Marchand
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-04-21 16:19 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-04-21 3:29 [dpdk-dev] [PATCH] lib/rte_eal: fix heap-use-after-free bug Wei Hu (Xavier)
2020-04-21 12:54 ` Burakov, Anatoly
2020-04-21 16:19 ` David Marchand
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).